HR Performance Solutions Performance Pro Stored Cross-Site Scripting Vulnerability
Vulnerability
A stored cross-site scripting vulnerability has been identified in the index.php component of HR Performance Solutions Performance Pro version 3.19.17. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Employee Notes, title, or description parameters.
Impact
Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.
Remediation
Users can upgrade to HR Performance Solutions Performance Pro version PP-Release-6.3.2.0 to address this vulnerability.
Added: Oct 21, 2025, 3:16 PM
Updated: Oct 21, 2025, 10:24 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
1.7exploitability
6.4remediation
7.7relevance
0.7threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.